Details
-
Bug
-
Resolution: Fixed
-
Critical
-
2.7.2, 3.4
-
None
-
Tested on 2.7.2 and 3.4, but probably most (all) versions are affected.
-
security, velocity
-
Medium
-
Description
By executing
{{velocity}}
#parse('WEB-INF/xwiki.cfg')
{{velocity}}
it is possible to read files within the WEB-INF folder like e.g. xwiki or hibernate config files.
We fixed this on our system and you should get a GitHub pull request in the next minutes.